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CLAIMS 

1. A method for associating computer network 
identifications with network policies, said method comprising the 
steps of : 

determining network identifications associated with a 

client computer; 
associating network identifications with locations; and 
feeding network identification/location pairs to a 

network interface module to implement desired 

network policies. 

2. The method of claim 1 wherein the network interface 
module is a module from the group of modules consisting of a 
firewall, a router, a sniffer, an intrusion detection module, a 
behavior blocking module, and a network communications module. 

3 . The method of claim 1 wherein the network interface 
module is a firewall, and a user of the client computer adjusts 
firewall settings to set network policies based upon location. 

4 . The method of claim 1 wherein the step of determining 
network identifications comprises using a plurality of network 
detectors to generate a set of netspecs. 

5. The method of claim 4 wherein the set of netspecs is 
prioritized. 
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6. The method of claim 5 wherein a user of the client 
computer prioritizes the set of netspecs via a prioritization 
module . 

7. The method of claim 1 wherein the step of associating 
network identifications with locations comprises using a network 
probe to look up locations in a netspec database. 

8. The method, of claim 7 wherein a user of the client 
computer modifies the netspec database via a location setting 
module . 

9. The method of claim 1 wherein the step of feeding network 
identification/location pairs to a network interface module 
comprises using a policy guide to feed the network 
identification/location pairs to the network interface module on 
a real-time basis. 

10. Apparatus for associating computer network 
identifications with network policies, said apparatus comprising: 

means for determining network identifications associated 
with a client computer; 

coupled to the determining means, means for associating 
network identifications with locations; and 

coupled to the associating means, means for feeding network 
identification/location pairs to a network interface module to 
implement desired network policies. 



18 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 



11. The apparatus of claim 10 wherein the network interface 
module is a module from the group of modules consisting of a 
firewall, a router, a sniffer, an intrusion detection module, a 
behavior blocking module, and a network communications module. 

12 . The apparatus of claim 10 wherein the network interface 
module is a firewall, and the network policies are implemented on 
a packet-by-packet basis. 

13 . The apparatus of claim 12 wherein locations are 
correlated with firewall settings on a distributed basis within 
the firewall. 

14. The apparatus of claim 10 wherein the determining means 
comprises : 

a plurality of network detectors coupled to the client 
computer; and 

coupled to the network detectors, a network probe 
adapted to associate network identifications 
revealed by the detectors with netspecs . 

15. The apparatus of claim 14 further comprising, coupled 
to the network probe, a prioritization module adapted to enable a 
user of the client computer to prioritize netspecs. 

16. The apparatus of claim 10 wherein the associating means 
comprises : 

a network probe adapted to produce netspecs 

corresponding to network identifications; and 
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coupled to the network probe, a netspec database 
associating netspecs with locations. 

17. The apparatus of claim 16 further comprising, coupled 
to the netspec database, a location setting module adapted to 
enable a user of the client computer to associate locations with 
netspecs . 

18. The apparatus of claim 10 wherein the feeding means 
comprises: 

a policy guide for associating network identifications 
with locations; wherein 

the network interface module implements network 

policies based upon locations fed to the network 
interface module by the policy guide. 

19. The apparatus of claim 10 further comprising, coupled 
to the network interface module, a user interface adapted to 
enable a user of the client computer to associate locations with 
network policies. 

20. Apparatus for associating computer network 
identifications with network policies, said apparatus comprising 

a plurality of network detectors associated with a 
client computer; 

coupled to the network detectors, a network probe 
adapted to associate each network identification 
revealed by a network detector with a netspec; 
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coupled to the network probe, a net spec database 

associating netspecs with locations; 
coupled to the network probe, a policy guide for 

associating network identifications with locations; 

and 

coupled to the policy guide, a network interface module 
adapted to implement network policies based upon 
locations fed to the network interface module by the 
policy guide. 

21. At least one computer- readable medium containing 
computer program instructions for associating computer network 
identifications with network policies, said computer program 
instructions performing the steps of: 

determining network identifications associated with a 

client computer ,- 
associating network identifications with locations; and 
feeding network identification/location pairs to a 
network interface module to implement desired 
network policies. 
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